1. A proposal for a Non Repudiation Protocol for epSOS Massimiliano Masi

2. Motivation EpSOS D3.7.2 defined the “Non Repudiation Security Service” (section 5.2) – ISO13888 tokens, Non Repudiation of Origin, of Receipt, of Delivery, and of Submission – Technologies indicated where IPSec, TLS, Message Payload Signatures, TTPs, and Audit Trails – To reduce the costs of the initial pilot (2009), “the required acknowledge of every message could be relaxed” (section 7.8.1)

3. Motivation The e-SENS project aims at the definition of Solution Building Blocks (SBB) SBB Interoperable Cross Border and Cross Domain (not only eHealth) SBB Guaranteed to be sustainable through CEF Existing LSP (such as epSOS) can use the e- SENS BB to enhance existing infrastructure

4. Motivation The e-SENS Non Repudiation Task Force defined a per-hop non repudiation protocol using notary services (Trusted Third Parties) Solution is eIDAS compliant Each actor (e.g., NCPs) stores evidence in the database, located in the same security zone of the TRC Issuer Solution: to fulfill the 3.7 requirements by using ATNA (as per 3.4.2) and ETSI REM

5. High Level Overview

6. Country B Message is in transit from B to A (e.g., XCA CrossGatewayRetrieve) – National Infrastructure MAY issue the NRO token (SubmissionAcceptanceRejection, SAR) – The message is received by NCPB, which MUST issue a NRR token (ReceiptNonReceipt, RNR) – NCPB performs internal operations – NCPB MUST issue a NRO token when the message is sent – All the tokens are stored in the Notary Service

7. Country A NCPA receives the message, and it MUST issue a NRR token NCPA performs internal operations NCPA MUST issue a NRO token before sending the new message to the national infrastructure National Infrastructure MAY issue a NRR token

8. Discussion Non Repudiation of message exchange Translation, Transcoding, Security, are not considered If National Infrastructures issues their tokens, there is an additional NRD evidence to be sent to the end-user No storage of documents in NCP No change in the epSOS message flow and message semantics Solution legally stable (eIDAS compliant) Tokens based on ETSI REM and ISO 13888 (under analysis) Highly flexible system through the usage of epSOS Extended Security Safeguard (ESS) XACML-based approach

9. Implementation Implementation is provided by e-SENS – OpenNCP just *INTEGRATES* It is based on the Evidence Emitter ABB Test performed by e-SENS (GITB testing) Gazelle’s test assertions, schema, are already integrated Schematrons are on their way